Thank you for your comment. XMLmao has been very useful to teach XPath Injection to my workmates, thanks. I think you should request the inclusion of XMLmao and SQLol into the WebApp Dojo as another training environment.

By the way, I’m using this email to tell you that there is a little problem with the app when you try to use the hex representation of some chars (as in %00) during a challenge. If you fill the textbox with ‘%00 for example, and click on the “Inject!” button, the app takes you to the main screen, where you should see the injection outcome. However, XMLmao is URL-encoding % sign, so as you can see in the second picture the ‘%00 injection payload becomes ‘%2500 and therefore the attack fails. What the user can do, is change the URL manually replacing %2500 by %00 and the attack will then succeed, but there might be a better solution.

Image1: http://i46.tinypic.com/f1w39d.png Image2: http://i45.tinypic.com/2je6b6s.png

Hope that helps. Thanks!